2 files changed, 11 insertions, 94 deletions
diff --git a/hosts/sagittarius/default.nix b/hosts/sagittarius/default.nix
index 8c98a0e..842c01e 100644
--- a/hosts/sagittarius/default.nix
+++ b/hosts/sagittarius/default.nix
@@ -1,5 +1,6 @@
 {
   pkgs,
+  config,
   ...
 }:
 {
@@ -11,7 +12,6 @@
     ./web
     ./sops.nix
     ./network.nix
-    ./headscale.nix
     ./auto-update.nix
   ];
 
@@ -39,6 +39,16 @@
     enableSSHSupport = true;
   };
 
+  services.tailscale = {
+    enable = true;
+    openFirewall = true;
+  };
+  networking.firewall = {
+    checkReversePath = "loose";
+    trustedInterfaces = [ "tailscale0" ];
+    allowedUDPPorts = [ config.services.tailscale.port ];
+  };
+
   users = {
     users = {
       ascella = {
diff --git a/hosts/sagittarius/headscale.nix b/hosts/sagittarius/headscale.nix
deleted file mode 100644
index 6874ad1..0000000
--- a/hosts/sagittarius/headscale.nix
+++ /dev/null
@@ -1,93 +0,0 @@
-{ pkgs, config, ... }:
-let
-  domain = "headscale.sorre.xyz";
-  port = 5892;
-in
-{
-  imports = [ ./web/acme.nix ];
-
-  services.headscale = {
-    enable = true;
-    inherit port;
-    address = "127.0.0.1";
-    settings = {
-      server_url = "https://${domain}";
-      dns = {
-        base_domain = "sorre.internal";
-        nameservers.global = [
-          "1.1.1.1"
-          "2301:db8:acad:a::1"
-        ];
-        extra_records = [
-          {
-            name = "vaultwarden.sorre.internal";
-            type = "AAAA";
-            value = "100.64.0.3";
-          }
-          {
-            name = "git.sorre.internal";
-            type = "AAAA";
-            value = "100.64.0.3";
-          }
-          {
-            name = "music.sorre.internal";
-            type = "AAAA";
-            value = "100.64.0.3";
-          }
-        ];
-      };
-    };
-  };
-  environment.systemPackages = [ config.services.headscale.package ];
-
-  services.nginx.virtualHosts."${domain}" = {
-    forceSSL = true;
-    enableACME = true;
-    locations."/" = {
-      proxyPass = "http://localhost:${toString port}";
-      proxyWebsockets = true;
-    };
-  };
-
-  # also enable the tailscale client since this is a node too
-  services.tailscale = {
-    enable = true;
-    openFirewall = true;
-  };
-  networking.firewall = {
-    checkReversePath = "loose";
-    trustedInterfaces = [ "tailscale0" ];
-    allowedUDPPorts = [ config.services.tailscale.port ];
-  };
-
-  systemd.services.backup-headscale = {
-    serviceConfig.Type = "oneshot";
-    description = "Back up headscale data";
-    conflicts = [ "headscale.service" ];
-    path = [
-      pkgs.gnutar
-      pkgs.systemdMinimal
-    ];
-    enableStrictShellChecks = true;
-    script = ''
-      #!/usr/bin/env bash
-      set -euo pipefail
-
-      [ ! -d /var/lib/backup/headscale ] && mkdir -p /var/lib/backup/headscale
-      TIMESTAMP="$(date +%Y%m%d%H%M%S)"
-      tar cvf "/var/lib/backup/headscale/$TIMESTAMP.backup.tar" /var/lib/headscale
-
-      find /var/lib/backup/headscale -type f -name '*.backup.tar' -print0 |
-        sort --zero-terminated --reverse |
-        tail --zero-terminated --lines=+6 |
-        xargs --null --no-run-if-empty rm --
-    '';
-    postStop = "systemctl start headscale.service";
-  };
-
-  systemd.timers.backup-headscale = {
-    description = "Back up headscale every morning";
-    timerConfig.OnCalendar = "*-*-* 05:00:00";
-    wantedBy = [ "timers.target" ];
-  };
-}